## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit Any WordPress user with Subscriber role or above can escalate to Administrator by sending a single POST request to the form submission endpoint, updating their own `wp_capabilities` user metadata field. ```http POST /wp-adm...
Read article →## The Exploit An unauthenticated attacker can upload arbitrary files to the server by crafting a multipart POST request to the form handler, exploiting missing file type and path validation in the upload handler. ```http POST /wp-admin/a...
Read article →## The Exploit An unauthenticated attacker can craft a malicious URL targeting any WordPress site running a vulnerable Freemius SDK version, then trick a user into clicking the link via social engineering. ```http GET /wp-admin/admin.php?...
Read article →## The Exploit An unauthenticated attacker can send a single HTTP request to delete arbitrary files on the WordPress server by supplying a path-traversal payload in the file deletion endpoint. ```http POST /wp-admin/admin-ajax.php HTTP/1....
Read article →## The Exploit An authenticated subscriber-level user can download arbitrary files from the server by calling the `mercadopagoDownloadLog` function with a path-traversal payload in the filename parameter. ```http POST /wp-admin/admin-ajax...
Read article →## The Exploit An authenticated user with subscriber-level permissions can execute arbitrary SQL queries through the `getQueryData()` AJAX handler by sending a POST request with a malicious `query` parameter. The plugin fails to validate t...
Read article →## The Exploit An authenticated WordPress user with Subscriber-level access can execute arbitrary PHP code on the server by sending a POST request to the `wp-admin/admin-ajax.php` endpoint with the `wpext_handle_snippet_update` action, pro...
Read article →## The Exploit An unauthenticated attacker who knows an arbitrary WordPress user's meta key and can predict or enumerate meta values can bypass authentication entirely and log in as that user. No nonce, no password, no session required. `...
Read article →## The Exploit An authenticated subscriber-level user can inject arbitrary SQL through the `b2sSortPostType` parameter to extract sensitive database records. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.wordpress.local Cont...
Read article →